Counting number of connections in a pcap file

Question

What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?

Answer 1

For TCP connections you could get a fairly good approximation by counting the SYN-ACK packets.

tcpdump -nr trace.pcap 'tcp[tcpflags] & (tcp-syn|tcp-ack) = (tcp-syn|tcp-ack)' | wc -l

For UDP there is no such thing as a connection, so you'll first have to define, what you want to count. You could count how many distinct pairs of source and destination are present in the file. This command will count packets in each direction separately, so if every "connection" sends packets in both directions, you'd have to divide by two.

tcpdump -nr trace.pcap 'udp' | cut -f2-5 -d' ' | sort -u | wc -l

If you prefer a GUI based tool, Wireshark can analyze TCP connections. It assigns a number to each TCP connection it finds in the file, so you can just scroll to the bottom of the file and look what number the last connection got assigned. (You may have to check multiple connections, if they are overlapping and some other connection continues after the last packet from the highest numbered connection.)

Answer 2

Wireshark can do this via Statistics→Conversations. TShark can do it via -q -z conv,tcp -r /path/to/capture.pcap and -q -z conv,udp -r /path/to/capture.pcap. Ntop should be able to do it as well.